id: "MA-03(01)" title: "Inspect Tools" family: "MA" family_name: "Maintenance" sort_id: "ma-03.01" priority: "P2" implementation_level: "organization" parent: "MA-03" enhancement: True
Statement
Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
Guidance
Maintenance tools can be directly brought into a facility by maintenance personnel or downloaded from a vendor’s website. If, upon inspection of the maintenance tools, organizations determine that the tools have been modified in an improper manner or the tools contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling.
Assessment Objective
maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications.
Maintenance policy
procedures addressing system maintenance tools
system maintenance tools and associated documentation
maintenance tool inspection records
maintenance records
system security plan
other relevant documents or records
Organizational personnel with system maintenance responsibilities
organizational personnel with information security responsibilities
Organizational processes for inspecting maintenance tools
mechanisms supporting and/or implementing the inspection of maintenance tools